Guided Product Walkthrough

Follow one finding from observation to resolution.

Use this illustrative journey with sample data to understand AI use, review a supported control decision and see the operator response. Classification can describe activity and detect sensitive content on selected fields; the policy determines the permitted action.

Walk through your workflow

Illustrative managed MCP case

Illustrative composite using sample data. The linked steps show operator work; they do not imply automatic case creation or a complete joined history.

  1. 1. Observed resource

    Sample endpoint WS-042 has a user-configured postgres-mcp installation. The inventory retains its provenance, ownership and last observation.

  2. 2. Applicable policy

    Illustrative signed policy engineering-mcp-v7 allows read operations and requires approval for delete. The request asks for a delete action.

  3. 3. Decision

    On this supported managed MCP path, the action is held before backend dispatch while approval is pending. Original argument inspection and the policy decision are recorded; the backend has not been called.

  4. 4. Case owner

    Sample responder Morgan owns the finding. The case records the endpoint, tool revision, policy version and pending action, using bounded evidence rather than a credential or raw query.

  5. 5. Remediation evidence

    The responder records withdrawal of the delete request and evidence of the corrected read-only workflow. The case retains the resolution and its supporting evidence.

Four gateway decisions to review separately

These independent illustrative examples use sample configurations. They are separate from the managed MCP case above and do not depict a joined live request or customer outcome.

Classification decision

Channel
Selected gateway prompt text
Policy
Illustrative text-policy-v3
Topic / activity
Drafting from a configured taxonomy
Risk signal
NoSignal from an observational stage
Permission
Enforcing policy decides access; the label is not a tool grant
Explore this gateway capability →

Eligible model selection

Channel
Supported routed model request
Policy
Illustrative model-routing-v4
Eligible candidates
Model A (economical) and Model B (frontier)
Selected model
Model A under the configured activity preference
Scope
Current eligibility, endpoint compatibility and signed bindings
Explore this gateway capability →

Usage and cost-control state

Channel
Governed provider attempt
Policy
Illustrative monthly-usage-v2
Quality
Reported, estimated and unknown cost kept distinct
Applied state
Current signed request-rate and permitted-model controls
Scope
Monthly threshold action is delayed and can overshoot
Explore this gateway capability →

Tool proposal before the harness

Channel
Configured protected provider response
Policy
Illustrative tool-release-v7
Inspected fields
Model-proposed tool call and selected arguments
Decision
Protected response withheld before harness delivery
Scope
Proposal delivery is distinct from backend execution
Explore this gateway capability →
Connect these records to governance questions →

Map the decision to its control point

Original argument denial on a supported managed MCP path can precede backend dispatch. A returned-result denial cannot undo an already executed action. Gateway policies apply to supported routed traffic; browser inspection uses selected prompt text and history selected by policy, with upload metadata controls. Direct provider and backend routes require separate controls.

Apply controls and review outcomes

Bring one real workflow to a session. Identify the resource, permitted route, selected fields, policy owner, exception scope and evidence needed for resolution.